Most beauty founders we talk to fall into one of two camps. Either they have not heard of MoCRA yet, or they have heard of it, feel a low-level anxiety about it, and keep pushing it down the to-do list. If you are in the second camp, this guide is for you. The requirements are real, most of them are already in effect, and the gap between where a lot of indie brands are today and where the FDA now expects them to be is wider than founders realize.

Quick Answer:

MoCRA (the Modernization of Cosmetics Regulation Act of 2022) is the biggest change to FDA cosmetics oversight since 1938. If you manufacture, pack, or distribute cosmetics in the U.S., you likely need to register your facility, list every product with the FDA, report serious adverse events within 15 business days, and maintain safety documentation. Small businesses averaging under $1 million in annual cosmetic sales may qualify for partial exemptions, but not always, depending on product type.

A note before we begin: nothing in this guide is legal advice. For questions specific to your brand, work with a regulatory consultant or attorney who specializes in cosmetics. This guide covers the basic framework every beauty ecommerce seller should understand.

Who This Covers

If you sell lip gloss, serums, body butter, mascara, hair treatments, nail products, or anything else that qualifies as a cosmetic under U.S. law, MoCRA applies to you. That includes one-person brands working out of a studio, brands manufacturing domestically, and brands importing finished goods from South Korea, China, or elsewhere.

The law defines “cosmetic” the same way the FDA always has: articles intended to be applied to the human body to cleanse, beautify, promote attractiveness, or alter appearance. That covers most of what indie beauty brands sell. The one category it does not cover: products that also make drug claims. More on that below — it matters more than most founders realize.

What MoCRA Changed and When

Congress passed MoCRA as part of the Consolidated Appropriations Act and President Biden signed it on December 29, 2022. That quiet signing, buried in a broader spending bill, is why a lot of founders missed it.

Before MoCRA, the FDA’s authority over cosmetics was minimal. A brand could sell a product without any pre-market review. Facility registration was voluntary. The FDA could act after a product caused harm but had almost no tools to prevent it. MoCRA gave the FDA mandatory registration authority, product listing requirements, the power to order recalls, and the foundation for formal manufacturing standards.

The requirements did not all take effect at once. Use this timeline to understand where you stand:

If your brand crossed the $1 million average revenue threshold, your registration and product listing deadlines have already passed. If you are under that threshold, your deadlines passed at the end of 2024. The clock is not still running — it has already stopped.

The Five Things MoCRA Requires

1. Facility Registration

Any facility that manufactures or processes cosmetics for U.S. distribution must register with the FDA through the Cosmetics Direct portal and renew that registration every two years. The FDA issues a Facility Establishment Identifier (FEI) number as the primary registration identifier.

If you use a contract manufacturer, that facility is responsible for its own registration. Ask for their FEI number and confirm it. Do not assume.

“Processing” under MoCRA covers more than manufacturing. A fulfillment center that performs kitting or custom labeling may also fall under this definition. The FDA can suspend a registration if it determines there is a reasonable probability a product from that facility could cause serious harm — and a suspended facility cannot legally distribute or sell cosmetics in the U.S.

2. Product Listing

Every cosmetic product you sell in the U.S. needs its own listing with the FDA, submitted through Cosmetics Direct. Each listing requires the product name, full ingredient list, facility information, Responsible Person contact details, and applicable cosmetic category.

Listings require annual updates. If you add a shade, reformulate, or launch a new product, the listing needs to reflect that. A single foundation line with 20 shades means 20 separate listings to maintain. For brands managing 60 or 80+ SKUs across shades and formulations, this is a meaningful ongoing administrative commitment.

3. Adverse Event Reporting

The Responsible Person — the manufacturer, packer, or distributor whose name appears on the product label — must report serious adverse events (SAEs) to the FDA within 15 business days of first learning about them. Serious adverse events include events requiring hospitalization, persistent or significant disability, birth defects, death, and events requiring medical or surgical intervention to prevent permanent harm.

The 15-day clock starts when you learn about the event, not when you investigate it. A customer DM describing an ER visit for an allergic reaction starts that clock. Train anyone on your customer service team to recognize the distinction between a standard complaint and a potential SAE, and establish a clear escalation path.

Recordkeeping: six years for standard businesses, three years for qualifying small businesses.

4. Safety Substantiation

The Responsible Person must maintain documentation demonstrating that each product is safe for its intended use. That documentation typically includes safety testing data, stability studies, ingredient safety assessments, and batch records.

Brands working with experienced, FDA-registered contract manufacturers who already operate under quality systems are usually in better shape here. If you formulate independently or work with small co-manufacturers, auditing your documentation is one of the more time-consuming parts of MoCRA compliance.

5. Labeling

Labels must now include domestic contact information — a U.S. address or contact point — for the Responsible Person, so consumers and the FDA can report adverse events.

Fragrance allergen labeling requirements are still in rulemaking. Once the FDA finalizes those rules, brands will need to disclose specific allergens in fragrance ingredients. Request full allergen data from your suppliers now. Updating labels during a planned production cycle costs far less than an emergency reformulation review.

Good Manufacturing Practices: What’s Still Coming

MoCRA directed the FDA to establish formal GMP regulations for cosmetics. As of May 2026, that final rule has not been published. When it does take effect, it will cover facility cleanliness and maintenance, personnel training, quality control documentation, and batch traceability.

The gap between current operations and eventual GMP compliance is narrower for brands already working with quality-focused manufacturers. Brands self-fulfilling from studio spaces or using generalist co-packers should treat the GMP delay as time to prepare, not time to wait.

The Small Business Exemption: Who Qualifies and What It Covers

If your average gross annual U.S. cosmetic sales over the previous three years are under $1 million, you may qualify as a small business under MoCRA. Qualifying small businesses are exempt from facility registration, product listing, and GMP requirements once finalized. The recordkeeping window for adverse events shortens to three years.

The exemption does not cover safety substantiation or adverse event reporting. Those requirements apply to every brand regardless of size.

The exemption also disappears for specific product types, regardless of revenue:

If any product in your line falls into one of these categories, full MoCRA requirements apply to your registration obligations across the board.

One calculation worth making now: the $1 million threshold uses a rolling three-year average. If your brand had a strong year — a viral TikTok moment, a press feature, a retail launch — you may have crossed or be approaching the threshold without realizing it. Run that math before you assume the exemption still applies.

The Cosmetic vs. Drug Line: The Most Common Mistake in Indie Beauty

This is the compliance risk that catches the most founders off guard, and MoCRA does not change it — it makes it more visible.

The FDA classifies products based on their intended use, and that classification determines which regulatory framework applies. A moisturizer is a cosmetic. A moisturizer that “repairs the skin barrier,” “reduces inflammation,” or “treats eczema” is making a drug claim, which reclassifies it as an OTC drug. Under that classification, MoCRA’s framework no longer applies. A much stricter one does.

These are the kinds of claims that create this risk:

• “Fights acne” or “clears breakouts”
• “Reduces fine lines” or “reverses signs of aging”
• “Controls oil production”
• “Repairs the skin barrier”
• “Stimulates collagen production”

Many of these appear on Shopify product pages, packaging, and TikTok content without founders realizing the regulatory implication. The FDA monitors marketing claims, and the agency has issued warning letters to beauty brands for exactly this. Review your copy against the FDA’s guidance on cosmetic vs. drug claims.

Private Label and White-Label: Who Is the Responsible Person?

A significant number of indie beauty brands buy finished formulations from a supplier, apply their own branding, and sell. MoCRA’s Responsible Person definition — the manufacturer, packer, or distributor whose name appears on the label — means that in most private label scenarios, you carry the compliance obligations.

Your supplier manufactured the formula. Your name is on the label. That makes you the Responsible Person for product listing and adverse event reporting, regardless of who formulated the product.

Get clarity from your supplier on three things: their facility’s FEI registration number, the safety substantiation documentation available for the formula, and the full ingredient list in a format you can submit for product listing. A supplier unwilling to provide these is a supplier creating compliance exposure for your brand.

International Sourcing: Manufacturing Outside the U.S.

If you source finished goods from a manufacturer in South Korea, China, Taiwan, or anywhere outside the U.S., MoCRA still applies to your brand’s obligations — and adds a layer for the manufacturer as well.

Foreign facilities that manufacture or process cosmetics for U.S. distribution must register with the FDA, just like domestic facilities. Before your products enter U.S. commerce, confirm your foreign manufacturer is registered and has an FEI number.

For customs purposes, inconsistent documentation — fluctuating declared values, vague product descriptions, missing safety data — draws scrutiny. CBP and the FDA coordinate on import screening. Products arriving from unregistered facilities face detention.

Build facility registration verification into your supplier vetting process. Switching manufacturers because a supplier failed to register is an expensive and disruptive problem to solve mid-production cycle.

“Clean,” “Natural,” and “Organic” Claims

The FDA has no formal definitions for “clean,” “natural,” or “organic” in cosmetics. Brands use these terms freely, and the FDA does not regulate them directly. But MoCRA changes the context.

With mandatory product listing now in effect, the FDA has access to full ingredient lists for cosmetics in the U.S. for the first time. The agency already used that data — publishing a PFAS safety review in December 2025 drawing on newly submitted listing data. The same scrutiny will follow other ingredient categories where marketing claims and formulation reality diverge.

The practical risk today is not an FDA enforcement action for calling something “clean.” The risk is an Amazon or TikTok Shop compliance audit, a journalist who pulls your product listing data, or a customer who reads the ingredient list. Get honest about what your formulations contain before that moment comes from outside.

Product Categories That Need Extra Attention

Fragrances

Most perfumes and colognes contain over 70% alcohol, placing them in Hazmat Class 3 (Flammable Liquids) under DOT and IATA rules. This affects storage, handling, and shipping. Most general-purpose 3PLs do not handle Class 3 hazmat and will decline the work without disclosing that limitation until after you have signed an agreement. Pending fragrance allergen labeling rules will require brands to disclose specific allergens in fragrance ingredients — request full allergen data from your suppliers now.

Talc-Containing Products

The FDA has proposed testing standards for detecting asbestos in talc-containing cosmetics. If talc appears in any of your formulations, request asbestos-testing documentation from your supplier in the form of certificates of analysis. If your supplier cannot produce it, treat that as a supplier risk.

Nail Products

Nail hardeners, gel removers, and products containing methylene chloride carry their own chemical hazard classifications. The FDA issued a consumer alert in 2025 specifically about methylene chloride in gel nail polish removers — it is prohibited in cosmetics at any concentration. If you sell nail products, a current ingredient review is not optional.

PFAS

In December 2025, the FDA published a safety review of the 25 most commonly used PFAS in cosmetics, drawing on the new product listing data MoCRA created. PFAS appear in products to improve texture, shine, and water resistance. If you use ingredients in these categories, confirm with your supplier whether PFAS are present in your formulations.

How Your Fulfillment Operation Connects to MoCRA Compliance

Compliance does not end at your formulation and your label. MoCRA’s adverse event reporting and recall authority both depend on traceability through your entire supply chain, including wherever your products are stored and shipped from.

Lot Tracking and the 15-Day Window

If a customer reports a serious adverse event and you need to identify every other customer who received product from the same lot, you have 15 business days to report to the FDA. That requires lot-level tracking through your entire fulfillment process, not just at the manufacturing level.

Your warehouse management system needs to record which lot number is in which pick location, flag lots under investigation for quarantine, and produce a complete shipment history for a given lot on short notice. Many general-purpose 3PLs track inventory at the SKU level without lot granularity. For cosmetics, SKU-level tracking is not sufficient.

Ask your current or prospective 3PL to walk you through a recall scenario: a specific lot, a Friday afternoon call, what happens in the next two hours. The answer tells you whether the capability is real or just on a features page. See our beauty and cosmetics fulfillment guide for more on how lot tracking and FEFO work in practice.

FEFO Inventory Rotation

Shipping a product that has expired, or that will expire before a customer can reasonably use it, creates both a brand problem and a potential compliance problem. The correct inventory rotation method for beauty and personal care is FEFO: First-Expired, First-Out. The product closest to its expiration date ships first, regardless of when it arrived.

Most general warehouses use FIFO — they ship whatever arrived first. FIFO does not account for expiration dates and will send a newer batch ahead of an older one that expires sooner. For active ingredients like retinol and vitamin C, this creates real risk.

Climate Control and Formula Integrity

Cosmetic formulas degrade in improper storage conditions. A serum stored in a warm warehouse loses potency before it reaches the customer. Products that arrive degraded generate complaints and returns that can rise to the level of adverse event reports under MoCRA’s framework. Ask your 3PL for the specific temperature range they maintain year-round and how they document it.

Returns Documentation

Under MoCRA’s adverse event framework, returns need a documentation trail that connects back to lot and batch data. A customer returning a product with a reaction that qualifies as an SAE triggers a compliance obligation. If your returns process cannot link that return to a specific lot, you cannot meet the reporting requirements.

What Happens When You Don’t Comply

Let’s say you get an email on a Thursday afternoon from a customer who had a severe allergic reaction after using your tinted moisturizer and spent two nights in the hospital. That is an SAE. Your 15-day reporting window starts now.

You contact your 3PL to identify every other customer who received product from the same lot. They tell you they track by SKU, not by lot number. You call your contract manufacturer. They can tell you when the batch was produced but not where all of it went. You spend four days manually reconstructing shipment records from order exports, Shopify data, and fulfillment logs.

You miss the 15-day window. The FDA, now aware of the adverse event through the customer’s own report, contacts you. Your product listing is out of date. Your facility registration lapsed six months ago.

The FDA’s enforcement tools under MoCRA: mandatory recalls, facility registration suspension that halts U.S. distribution, classification of products as adulterated or misbranded, detention at customs, and civil or criminal penalties in serious cases. A voluntary compliance review before a crisis costs time and money. A forced recall during a product launch costs significantly more, including the brand equity that takes years to rebuild.

How to Evaluate a 3PL for MoCRA Compliance

When you assess fulfillment partners for beauty and cosmetics, the compliance-relevant questions are specific.

• Are you FDA-registered?  Relevant if they perform any kitting or custom labeling. Required if they cross into processing territory.
• Walk me through a lot recall.  Ask for a specific scenario: a lot number, a Friday call, what happens in the next two hours. A 3PL with genuine lot tracking capability can walk through this in detail.
• How do you handle FEFO rotation?  Not whether they do it — how. Ask them to describe the system.
• Can you document chain of custody for a specific lot number?  This is what an FDA adverse event investigation will ask for.
• What temperature range do you maintain, and how do you monitor it?  A specific number and a documented monitoring system, not a marketing claim.

At EFS, we have worked with beauty and cosmetics brands for 25+ years. Our inventory management system tracks by lot and enforces FEFO at the pick-face level, with recall documentation and quarantine workflows built for the 15-day adverse event window. See our beauty and cosmetics fulfillment services for a full look at how we handle traceability for this category.

MoCRA FAQs

For questions about how your fulfillment operation connects to MoCRA’s traceability requirements, the team at EFS is available to walk through your specific product mix and volume. Explore EFS Beauty & Cosmetics Fulfillment or contact us directly.